Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15B23666141B6447A2543A3D4B231B76BA2D2F305CF1B539981FC8398DBCADB1ED2F660 |
|
CONTENT
ssdeep
|
768:MWobSMMwRks71NTXYGMy/aDRksj1/TXGGxy/a1/T/XGOOClkQNzwetjTyTthHNlA:MwwRks71NTXYGMy/aDRksj1/TXGGxy/2 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d42f48dd8a9703a7 |
|
VISUAL
aHash
|
1800437ffffefe7c |
|
VISUAL
dHash
|
f20ecfe86004a4e9 |
|
VISUAL
wHash
|
0000007efefefe7c |
|
VISUAL
colorHash
|
060000c8200 |
|
VISUAL
cropResistant
|
f20ecfe86004a4e9 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 134 techniques to evade detection by security scanners and make reverse engineering more difficult.